Google Professional Cloud Developer Question 231
Single answerGoogle Cloud PlatformYou are developing a web application that needs to connect securely to a Cloud SQL instance. To minimize the complexity of managing credentials and to ensure your application can authenticate securely, which approach should you take?
- A
Use a Cloud SQL Auth proxy and authenticate using a service account key stored in your application code.
- B
Use a Cloud SQL Auth proxy and authenticate using a service account with the appropriate IAM role.
- C
Directly include the database username and password in your application code to connect to the Cloud SQL instance.
- D
Use the Cloud SQL instance's public IP and connect using basic authentication with a user-managed credential.
Show answer and explanation
Correct answer: B
Explanation
Using the Cloud SQL Auth proxy with a service account that has the necessary IAM roles is the most secure and recommended way to authenticate and connect to Cloud SQL. This approach minimizes credential management complexity, uses IAM for role-based access control, and ensures that connections are encrypted and managed securely.
- A. Incorrect.
Storing service account keys in your application code is not recommended due to security risks, as this exposes your application to potential credential theft and mismanagement.
- B. Correct.
Using the Cloud SQL Auth proxy with a service account is the recommended approach. The proxy handles secure authentication and connection management, and the service account ensures proper IAM-controlled access.
- C. Incorrect.
Hardcoding credentials such as database usernames and passwords in your application code is highly insecure and against best practices. This can lead to accidental credential leaks.
- D. Incorrect.
Connecting directly using a Cloud SQL instance's public IP with user-managed credentials is possible but less secure and does not take advantage of secure authentication mechanisms like the Cloud SQL Auth proxy.